Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About FelixLeh
FelixLeh
Contributor
Member since:
11-23-2020
01-24-2024
Community Statistics
| Posts | 84 |
| Solutions | 18 |
| Karma Given | 7 |
| Karma Received | 19 |
| Member Since | 11-23-2020 |
Activity Feed
- Karma Re: Restart Server error for gn694. 11-20-2023 05:19 AM
- Got Karma for Re: What are the limitations with Splunk Enterprise version 9.0.4. 11-14-2023 10:18 PM
- Posted Re: Conditional timechart condiftion on Dashboards & Visualizations. 11-09-2023 01:34 AM
- Posted Re: how to join 2 lookup files to combine all the rows. on Splunk Search. 11-09-2023 12:46 AM
- Got Karma for Re: Comparing every elements in a list with a table. 11-08-2023 08:09 AM
- Karma Re: How to limit search results to * % of all results for PickleRick. 11-08-2023 06:48 AM
- Posted Re: How to limit search results to * % of all results on Splunk Search. 11-08-2023 06:47 AM
- Posted Re: How to limit search results to * % of all results on Splunk Search. 11-08-2023 06:31 AM
- Posted Re: how to join 2 lookup files to combine all the rows. on Splunk Search. 11-08-2023 06:12 AM
- Karma Re: how to enable initialized flag in search head cluster for gcusello. 11-08-2023 06:05 AM
- Posted Re: how to enable initialized flag in search head cluster on Deployment Architecture. 11-08-2023 05:34 AM
- Posted Re: how to join 2 lookup files to combine all the rows. on Splunk Search. 11-08-2023 05:27 AM
- Posted Re: Comparing every elements in a list with a table on Splunk Search. 11-08-2023 05:00 AM
- Posted Re: What are the limitations with Splunk Enterprise version 9.0.4 on Splunk Enterprise. 11-08-2023 04:21 AM
- Posted Re: How to filter out the EVENT_TYPE in sfdc:logfile using Splunk Add on for Salesforce? on All Apps and Add-ons. 11-07-2023 08:19 AM
- Got Karma for Re: Add daily stats to Search. 11-07-2023 06:18 AM
- Posted Re: Stats and Look up on Splunk Search. 11-07-2023 04:11 AM
- Posted Re: Stats and Look up on Splunk Search. 11-07-2023 03:06 AM
- Posted Re: Stats and Look up on Splunk Search. 11-07-2023 02:38 AM
- Posted Re: parse ps command on Splunk Search. 11-07-2023 01:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-09-2023
01:34 AM
index=asa host=1.2.3.4
| fillnull src_sg_info value="No active VPN user"
| timechart span=10m dc(src_sg_info) by src_sg_info
| rename user1 as "David E"
... View more
11-09-2023
12:46 AM
@bowesmana am I misunderstanding what @Anud wants to achieve? For me it sounded like a simple lookup combined with a inputlookup.
... View more
11-08-2023
06:47 AM
Great Solution! But there was a typo and it disregarded the amount of count. Added a sort to your solution. <your_search>
| stats count by user
| sort - count
| eventstats count as total
| streamstats count as current
| where current<=0.15*total
... View more
11-08-2023
06:31 AM
You can either use the top command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top) | top <your_field> limit=<your_choice> OR you can use sort and the use head | sort - count
| head <number_of_choice> If this is inside a dashboard you could create a token based on the amount of search results and input it as the number for head or top command.
... View more
11-08-2023
06:12 AM
Yes. 1. You have to Load the Second lookup into your search. You do so by loading the lookup file with the inputlookup command. |inputlookup fileB.csv 2. A lookup that is inside splunk can be used to add data onto existing events or table data. To do so you have to use the lookup command. You tell Splunk the name of the lookup, which field it shall use to add the data and which fields to add from the lookup | lookup fileA.csv A OUTPUT E Since field A are both in fileA and fileB you can use it to enrich your table with data from the other lookup. You tell splunk that you want to add data from fileA.csv and that the file that is present in both datasets is A then you tell Splunk to OUTPUT the field E to the current table. This results in a query like in my previous answer. When the correct fieldnames and lookup file names are used this should lead to your desired output.
... View more
11-08-2023
05:34 AM
Check in the Monitoring Console -> Settings -> General Setup If all Roles are assigned correctly. Is distributed mode turned on?
... View more
11-08-2023
05:27 AM
| inputlookup fileB.csv
table A E F
|lookup fileA.csv A OUTPUT E
... View more
11-08-2023
05:00 AM
1 Karma
|eval output3 = replace(output3,"[\[\]\"]","")
|makemv output3 delim=","
|mvexpand output3
|rename output3 as id
|join id
[<second_search>] If you want to keep the original values of id from the first search add a temporary field: |eval temp = replace(output3,"[\[\]\"]","")
|makemv temp_id delim=","
|mvexpand temp_id
|rename temp_id as id
|join id
[<second_search>] If you want to combine the results of the second query back together add this to the end: | mvcombine id Keep in mind that join only works with up to 50.000 events but it doesn't seem like this limitation is relevant to your situation based on the example. If the second search is a static list of codes that you want to match you could also put the results of the second query in to a lookup table: |eval temp = replace(output3,"[\[\]\"]","")
|makemv temp_id delim=","
|mvexpand temp_id
|rename temp_id as id
|lookup <lookup_name> id OUTPUT id as found
|where isnotnull(found)
|fields - found
... View more
11-08-2023
04:21 AM
1 Karma
The Default index in the Splunk is the main index. The Definition is located in the indexes.conf. defaultDatabase = <database name> Additionally every User Role can have a custom default index assigned. You can check the default index for a user role by going into Settings -> Roles -> Your Role -> 3. Indexes Check if the default for the environment or your user role is the same as the index which the data is shown from when you search without an index. Regarding the missing fields I currently have no lead.
... View more
11-07-2023
08:19 AM
As far as I can tell your configuration checks out. The problem could be that the input for salesforce is over an API/Script. Different types of inputs behave differently with the configurations and some even skip certain parts of the pipeline. If it was a normal Monitoring Input and your mentioned configuration is on the indexer everything should work. I have to gather more info myself regarding the transformation of the API inputs to help you further on this.
... View more
11-07-2023
04:11 AM
| stats count(Tran) as count , Avg( responstime) as avgrt by Tran
| rex field=Tran "(?<temp>^[A-Z]{3})"
| lookup TransctionDetails.csv Tran_lookup as temp OUTPUT Transaction_Details
| fields Count ,Tran, Transaction_Details, avgrt I extract the first three letters from the Tran field and put it in a separate field. Then I make the lookup against the file with the new field.
... View more
11-07-2023
03:06 AM
| stats count(Tran) as count , Avg( responstime) as avgrt by Tran
| lookup TransctionDetails.csv Tran_lookup as Tran OUTPUT Transaction_Details
| fields Count ,Tran, Transaction_Details, avgrt if you only want the Events that have matching Transaction_Details add: | where isnotnull(Transaction_Details) My Expectation in the Example is that the Lookup is inside of Splunk and correctly configured.
... View more
11-07-2023
02:38 AM
With the lookup command I mentioned in my first reply you can do so. You have to replace "<lookup_name>" with the name of your lookup. If the field names you mentioned are correct then the query should work. Just add the line after the current result. If it still doesnt work pls provide more information like the name of the lookup file, the exact names of the fields in the result and the exact names of the fields in the lookup file.
... View more
11-07-2023
01:56 AM
Try this: | rex field=_raw "(?<header>[^\n]+)"
| eval temp = split(_raw,"
")
| mvexpand temp
| regex temp="proc\d+"
| rex field=temp "(?<USER>[^\s]+)\s(?<PID>[^\s]+)\s(?<CPU>[^\s]+)\s(?<MEM>[^\s]+)\s(?<VSZ>[^\s]+)\s(?<RSS>[^\s]+)\s(?<TTY>[^\s]+)\s(?<STAT>[^\s]+)\s(?<START>[^\s]+)\s(?<TIME>[^\s]+)\s(?<COMMAND>[^\s]+)"
| rename CPU as "%CPU" MEM as "%MEM"
| fields - temp You can then use transforming commands with the COMMAND field (procs). Also be careful to keep the new line in the query in the split command to split correctly. If that doesnt work try "\n" instead. EDIT: The Version from @ITWhisperer with mvindex is simpler...
... View more
11-07-2023
01:39 AM
| lookup <lookup_name> Tran_lookup as Tran OUTPUT Transaction_Details Its recommended to create a lookup definition for your lookup files. If you do so you replace the lookup name with the name of the lookup definition. Hope this helps!
... View more
11-07-2023
12:08 AM
1 Karma
My bad. I forgot to add a time variable to the eventstats. By disregarding time the query checks whether a user has more than 10 failed logins over the entire search span. If your data already has a date stamp then you can use that. Alternatively you could adjust the query like this: index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=Host1 OR host=host2)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds
| eval temp_date = strftime(_time, "%Y-%m-%d")
| eventstats count as failed_count by IONS,temp_date
| where failed_count>=10
| timechart dc(IONS) as IONS span=1d
... View more
11-06-2023
03:31 AM
Depening on how many Apps are disregarded by the Readiness App you could check the Outlier Apps on Splunkbase. If your currently installed version supports Splunk 9.x it should support Python 3 as well. A note regarding 9.x Upgrades: While upgrading to 9.x from 8.x or lower; check how much storage your KV Stores take up on your systems. The KV Storage gets upgraded in the process of the Update and Splunk wants to backup all Kvstores in the process. This requires at least twice the amount of storage your KVStores currently use. If you don't do so you have to manually upgrade them afterwards instead of as part of the Splunk Upgrade Process.
... View more
11-06-2023
03:23 AM
Everything that is needed should hopefully be found here: https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller LOGON_USERNAME="<domain\username>" LOGON_PASSWORD="<pass>" Provide domain\username and password information for the user to run the SplunkForwarder service. Specify the domain with the username in the format: domain\username. If you don't include these flags, the universal forwarder installs as the Local System user. The Troubleshooting at the bottom of the link could also lead to answers regarding permissions and local admin groups
... View more
11-06-2023
02:23 AM
I haven't worked with this particular addon but normally if you would like to exclude events from indexing you'd create a section in the transforms.conf [choose_a_unique_name]
REGEX = regex_that_matches_events_that_you_want_to_exclude
DEST_KEY = queue
FORMAT = nullQueue and then add it to you the sourcetype/source/host in the props.conf. [sourcetype_name]
TRANSFORMS-unique_name = name_from_the_transforms.conf Since this is an addon not developed by you these changes should be done in local. Eventtypes are used on data that is already indexed in Splunk. This is why you cant use them to stop certain data from getting indexed into Splunk since they are calculated at search time.
... View more
11-06-2023
02:08 AM
1 Karma
Could this help maybe? https://community.splunk.com/t5/Splunk-Search/Why-are-large-Splunk-searches-causing-quot-Request-URI-too-long/m-p/437368
... View more
11-06-2023
01:26 AM
If you want to see only data that is before the 30th the following line does not make sense: | eval timeline2=relative_time(timeline1,"-1w@w1") The data is correct but since you reduce the timeline date by 1 week it shows 23rd October instead of 30th.. Its purely visual though. The data does not change because of this command since you are not filtering against the time of the events after the change. Just remove this line and the data should be correct Additionally I'd suggest using the same time conversion. Converting weeks with %V starts at count 1 while doing it with %U starts at 0. You are using both in the same Query. | eval lastmodifiedWeek=strftime(epoc_last_modified,"%Y-%U")
|eval timeline="30-Oct-23"
| eval timeline_date=strptime(timeline,"%d-%b-%y")
|eval new_timeline=strftime(timeline_date,"%Y-%U")
|where lastmodifiedWeek<=new_timeline
| stats count by Lookup lastmodifiedWeek
| eval timeline1 = strptime(lastmodifiedWeek." 1", "%Y-%U %w")
| eval timeline = strftime(timeline1, "%Y-%m-%d")
| table timeline , Lookup count
|chart values(count) as count over timeline by Lookup |fillnull value=0 |tail 4 |reverse If I missundestood you and you want the data that comes after the 30th then you'd additionally have to change the "where" line to the following: |where lastmodifiedWeek>=new_timeline
... View more
11-03-2023
07:46 AM
1 Karma
If I understand you correctly the query should work like this: index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=Host1 OR host=host2)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds
| eventstats count as failed_count by Device IONS
| where failed_count>=10
| timechart dc(IONS) as IONS span=1d This will show you the amount of user with more than 10 failed logons on each day.
... View more
08-11-2023
05:21 AM
3 Karma
Found the solution myself and wanted to post anyway because I haven't found solutions in the community that summarised the issue. If I missed one please feel free to link it here so people can find it easier.
... View more
08-11-2023
05:19 AM
We had a problem that certain fields weren't searchable. index=foo bar=* did not show any result even though interesting fields and the events themselves showed that the fields were extracted as expected. Searching specific values also didn't help. Some fields did return results but only if you added wildcards: index=foo bar="*value" It was possible to find the events when using: | where isnontull(foo) OR | eval check = if(foo="bar",1,0)
| where check = 1 but any other method did not return results. After some research in the community I found Posts with similar problems. Some suggested that there could be hidden fields present. Most of the time the suggestion was to enable indexed extractions with the fields.conf and adding a wildcard there. [MyField]
INDEXED_VALUE = *<VALUE> While trying out whether this option would work for me, I compared existing fields.conf files in the environment and noticed that all of the affected missing field values are part of the fields.conf of another app. By default fields.conf is global if im not mistaken hence the fields defined in fields.conf as indexed extraction affected other sourcetypes but since the fields in those other apps did not include the necessary parameters to successfully extract at index time this error occurred. Setting export to none in the metadata of the app that holds the fields.conf file solved my problem. local/default.meta: [fields]
export = none As seen in the fields.conf Docs: * Do not create indexed fields with names that collide with names of fields
that are extracted at search time. I was aware of this setting regarding creating new fields myself but forgot to check whether any of the installed apps already do so. Hope this helps anyone that may be in a similar situation! TLDR: If you have trouble with extracted fields and cant search them even though they are shown inside the events and interesting fields, check your environment for fields.conf and if the affected fields are defined as indexed extraction. If so limit the fields.conf with metadata to the original app.
... View more
Labels
- Labels:
-
field extraction
-
fields
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2024
12:29 AM
|
